Index: head/sys/dev/iwm/if_iwm.c
===================================================================
--- head/sys/dev/iwm/if_iwm.c
+++ head/sys/dev/iwm/if_iwm.c
@@ -2977,6 +2977,8 @@
 	/* rssi is in 1/2db units */
 	rxs.c_rssi = rssi * 2;
 	rxs.c_nf = sc->sc_noise;
+	if (ieee80211_add_rx_params(m, &rxs) == 0)
+		goto fail;
 
 	if (ieee80211_radiotap_active_vap(vap)) {
 		struct iwm_rx_radiotap_header *tap = &sc->sc_rxtap;
@@ -3013,11 +3015,11 @@
 	IWM_UNLOCK(sc);
 	if (ni != NULL) {
 		IWM_DPRINTF(sc, IWM_DEBUG_RECV, "input m %p\n", m);
-		ieee80211_input_mimo(ni, m, &rxs);
+		ieee80211_input_mimo(ni, m);
 		ieee80211_free_node(ni);
 	} else {
 		IWM_DPRINTF(sc, IWM_DEBUG_RECV, "inputall m %p\n", m);
-		ieee80211_input_mimo_all(ic, m, &rxs);
+		ieee80211_input_mimo_all(ic, m);
 	}
 	IWM_LOCK(sc);
 
Index: head/sys/dev/otus/if_otus.c
===================================================================
--- head/sys/dev/otus/if_otus.c
+++ head/sys/dev/otus/if_otus.c
@@ -1713,7 +1713,10 @@
 	rxs.c_nf = sc->sc_nf[0];	/* XXX chain 0 != combined rssi/nf */
 	rxs.c_rssi = tail->rssi;
 	/* XXX TODO: add MIMO RSSI/NF as well */
-	ieee80211_add_rx_params(m, &rxs);
+	if (ieee80211_add_rx_params(m, &rxs) == 0) {
+		counter_u64_add(ic->ic_ierrors, 1);
+		return;
+	}
 
 	/* XXX make a method */
 	STAILQ_INSERT_TAIL(&rxq->mq_head, m, m_stailqpkt);
@@ -1826,10 +1829,10 @@
 			if (ni != NULL) {
 				if (ni->ni_flags & IEEE80211_NODE_HT)
 					m->m_flags |= M_AMPDU;
-				(void)ieee80211_input_mimo(ni, m, NULL);
+				(void)ieee80211_input_mimo(ni, m);
 				ieee80211_free_node(ni);
 			} else
-				(void)ieee80211_input_mimo_all(ic, m, NULL);
+				(void)ieee80211_input_mimo_all(ic, m);
 		}
 #ifdef	IEEE80211_SUPPORT_SUPERG
 		ieee80211_ff_age_all(ic, 100);
Index: head/sys/dev/usb/wlan/if_rsu.c
===================================================================
--- head/sys/dev/usb/wlan/if_rsu.c
+++ head/sys/dev/usb/wlan/if_rsu.c
@@ -1536,10 +1536,12 @@
 	/* This is a number from 0..100; so let's just divide it down a bit */
 	rxs.c_rssi = le32toh(bss->rssi) / 2;
 	rxs.c_nf = -96;
+	if (ieee80211_add_rx_params(m, &rxs) == 0)
+		return;
 
 	/* XXX avoid a LOR */
 	RSU_UNLOCK(sc);
-	ieee80211_input_mimo_all(ic, m, &rxs);
+	ieee80211_input_mimo_all(ic, m);
 	RSU_LOCK(sc);
 }
 
Index: head/sys/net80211/ieee80211_input.c
===================================================================
--- head/sys/net80211/ieee80211_input.c
+++ head/sys/net80211/ieee80211_input.c
@@ -83,18 +83,14 @@
 }
 
 int
-ieee80211_input_mimo(struct ieee80211_node *ni, struct mbuf *m,
-    struct ieee80211_rx_stats *rx)
+ieee80211_input_mimo(struct ieee80211_node *ni, struct mbuf *m)
 {
 	struct ieee80211_rx_stats rxs;
 
-	if (rx) {
-		memcpy(&rxs, rx, sizeof(*rx));
-	} else {
-		/* try to read from mbuf */
-		bzero(&rxs, sizeof(rxs));
-		ieee80211_get_rx_params(m, &rxs);
-	}
+	/* try to read stats from mbuf */
+	bzero(&rxs, sizeof(rxs));
+	if (ieee80211_get_rx_params(m, &rxs) != 0)
+		return (-1);
 
 	/* XXX should assert IEEE80211_R_NF and IEEE80211_R_RSSI are set */
 	ieee80211_process_mimo(ni, &rxs);
@@ -111,27 +107,21 @@
 	rx.r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
 	rx.c_nf = nf;
 	rx.c_rssi = rssi;
-	return ieee80211_input_mimo_all(ic, m, &rx);
+
+	if (!ieee80211_add_rx_params(m, &rx))
+		return (-1);
+
+	return ieee80211_input_mimo_all(ic, m);
 }
 
 int
-ieee80211_input_mimo_all(struct ieee80211com *ic, struct mbuf *m,
-    struct ieee80211_rx_stats *rx)
+ieee80211_input_mimo_all(struct ieee80211com *ic, struct mbuf *m)
 {
-	struct ieee80211_rx_stats rxs;
 	struct ieee80211vap *vap;
 	int type = -1;
 
 	m->m_flags |= M_BCAST;		/* NB: mark for bpf tap'ing */
 
-	if (rx) {
-		memcpy(&rxs, rx, sizeof(*rx));
-	} else {
-		/* try to read from mbuf */
-		bzero(&rxs, sizeof(rxs));
-		ieee80211_get_rx_params(m, &rxs);
-	}
-
 	/* XXX locking */
 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
 		struct ieee80211_node *ni;
@@ -152,6 +142,7 @@
 			/*
 			 * Packet contents are changed by ieee80211_decap
 			 * so do a deep copy of the packet.
+			 * NB: tags are copied too.
 			 */
 			mcopy = m_dup(m, M_NOWAIT);
 			if (mcopy == NULL) {
@@ -163,7 +154,7 @@
 			m = NULL;
 		}
 		ni = ieee80211_ref_node(vap->iv_bss);
-		type = ieee80211_input_mimo(ni, mcopy, &rxs);
+		type = ieee80211_input_mimo(ni, mcopy);
 		ieee80211_free_node(ni);
 	}
 	if (m != NULL)			/* no vaps, reclaim mbuf */
Index: head/sys/net80211/ieee80211_proto.h
===================================================================
--- head/sys/net80211/ieee80211_proto.h
+++ head/sys/net80211/ieee80211_proto.h
@@ -83,10 +83,8 @@
 	((ni)->ni_vap->iv_input(ni, m, NULL, rssi, nf))
 int	ieee80211_input_all(struct ieee80211com *, struct mbuf *, int, int);
 
-int	ieee80211_input_mimo(struct ieee80211_node *, struct mbuf *,
-	    struct ieee80211_rx_stats *);
-int	ieee80211_input_mimo_all(struct ieee80211com *, struct mbuf *,
-	    struct ieee80211_rx_stats *);
+int	ieee80211_input_mimo(struct ieee80211_node *, struct mbuf *);
+int	ieee80211_input_mimo_all(struct ieee80211com *, struct mbuf *);
 
 struct ieee80211_bpf_params;
 int	ieee80211_mgmt_output(struct ieee80211_node *, struct mbuf *, int,